CVE-2021-39185 - CVE House
Back to Database
Status published Critical CVE-2021-39185

Default CORS config allows any origin with credentials

Vulnerability Description

Http4s is a minimal, idiomatic Scala interface for HTTP services. In http4s versions 0.21.26 and prior, 0.22.0 through 0.22.2, 0.23.0, 0.23.1, and 1.0.0-M1 through 1.0.0-M24, the default CORS configuration is vulnerable to an origin reflection attack. The middleware is also susceptible to a Null Origin Attack. The problem is fixed in 0.21.27, 0.22.3, 0.23.2, and 1.0.0-M25. The original `CORS` implementation and `CORSConfig` are deprecated. See the GitHub GHSA for more information, including code examples and workarounds.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-39185

Credits & Attribution

No credits recorded in the NVD database.

References

More from http4s

View All →
CVE-2025-59822
Http4s vulnerable to HTTP Request Smuggling due to improper handling of HTTP trailer section
Medium 6.3
CVE-2023-22465
Http4s has fatal error parsing User-Agent and Server headers
High 7.5
CVE-2021-41084
Response Splitting from unsanitized headers in http4s
High 8.7
CVE-2021-32643
StaticFile.fromUrl can leak presence of a directory
Medium 5.8
CVE-2021-21294
Unbounded connection acceptance in http4s-blaze-server
High 7.5

Affected Vendor

Affected Software

http4s
Vulnerable Versions:
< 0.21.27, >= 0.22.0, < 0.22.3, >= 0.23.0, < 0.23.2, >= 1.0.0-M1, <= 1.0.0-M24

Timeline

Official Publish: September 1st, 2021
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses (CWE)

CWE-346

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1565.002 Stored Data Manipulation
Impact